Overview

overview

10

Static

static

1

Celery.exe

windows7-x64

10

Celery.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Celery.exe

  • Size

    800.0MB

  • Sample

    240426-z64lfacd84

  • MD5

    b4c744abf264ef21108c72d281704b41

  • SHA1

    f865c64edce99bade55b7d097d8dda842655cc55

  • SHA256

    321f32aca8d188e7164272993d747933c61e15e852f90035c99c09dec2d4f2b5

  • SHA512

    1e9386367aea49f5a86ed34793179e52c45f250ad7776bd212eeea2c91d09e7b0e18ca69353092d3c206bd94a97cd01a9247df8260b5368becede52c4c5d0961

  • SSDEEP

    49152:uWBRH4OPyauD8t5WJEmdwAl/zSC++SKQ:uWBRHrPyauD8tRKzSCMJ

Score
10/10
redlinezgratdiscoveryinfostealerratspywarestealer

Malware Config

Targets

    • Target

      Celery.exe

    • Size

      800.0MB

    • MD5

      b4c744abf264ef21108c72d281704b41

    • SHA1

      f865c64edce99bade55b7d097d8dda842655cc55

    • SHA256

      321f32aca8d188e7164272993d747933c61e15e852f90035c99c09dec2d4f2b5

    • SHA512

      1e9386367aea49f5a86ed34793179e52c45f250ad7776bd212eeea2c91d09e7b0e18ca69353092d3c206bd94a97cd01a9247df8260b5368becede52c4c5d0961

    • SSDEEP

      49152:uWBRH4OPyauD8t5WJEmdwAl/zSC++SKQ:uWBRHrPyauD8tRKzSCMJ

    Score
    10/10
    redlinezgratdiscoveryinfostealerratspywarestealer

    • Detect ZGRat V1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Process Discovery

1
T1057

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks